ef66ca202f1f0998c13d8d350bf26bd8206c0979bfb5e84ef511ff2adb58403b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 16:01

Target

7aab786f4c6ad38b740cc55f7c064b2b.exe
Size

267KB
MD5

7aab786f4c6ad38b740cc55f7c064b2b
SHA1

634aac422ecaf0174ba3fcaf5eb3ea46926583f4
SHA256

ef66ca202f1f0998c13d8d350bf26bd8206c0979bfb5e84ef511ff2adb58403b
SHA512

2480195254b32bd551e51b072c7c565f511971e41a411c3366c0afb3e5aa3cf1ac135f3725c6a89ad13754157202f2ec9c153e5b9b91063b58c93bb32923c76b
SSDEEP

6144:vWk8KqCvFv75WDwBH7h78s5PnAJJDIUBxaz3sGgKpcPTb:OkJXvTW21h5uJDxKsGfpcr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2180	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2208	2180	7aab786f4c6ad38b740cc55f7c064b2b.exe	28
PID 2180 wrote to memory of 2208	2180	7aab786f4c6ad38b740cc55f7c064b2b.exe	28
PID 2180 wrote to memory of 2208	2180	7aab786f4c6ad38b740cc55f7c064b2b.exe	28
PID 2180 wrote to memory of 2208	2180	7aab786f4c6ad38b740cc55f7c064b2b.exe	28

C:\Users\Admin\AppData\Local\Temp\7aab786f4c6ad38b740cc55f7c064b2b.exe
"C:\Users\Admin\AppData\Local\Temp\7aab786f4c6ad38b740cc55f7c064b2b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 36
  2⤵
  - Program crash
  PID:2208

memory/2180-0-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2180-1-0x00000000002A0000-0x0000000000347000-memory.dmp

Filesize
668KB

Download